linux-kernel - Re: [PATCH v2] random: use SipHash as interrupt entropy accumulator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yi05ciQRhqa4MoF7@sol.localdomain>
Date:   Sat, 12 Mar 2022 16:23:14 -0800
From:   Eric Biggers <ebiggers@...nel.org>
To:     "Jason A. Donenfeld" <Jason@...c4.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux Crypto Mailing List <linux-crypto@...r.kernel.org>,
        Theodore Ts'o <tytso@....edu>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jean-Philippe Aumasson <jeanphilippe.aumasson@...il.com>
Subject: Re: [PATCH v2] random: use SipHash as interrupt entropy accumulator

On Sat, Mar 12, 2022 at 05:07:05PM -0700, Jason A. Donenfeld wrote:
> Hi Eric,
> 
> On Sat, Mar 12, 2022 at 2:39 PM Eric Biggers <ebiggers@...nel.org> wrote:
> > On Sun, Mar 06, 2022 at 09:51:23AM -0700, Jason A. Donenfeld wrote:
> > > For this, we make use of SipHash-1-x on 64-bit and HalfSipHash-1-x on
> > > 32-bit, which are already in use in the kernel and achieve the same
> > > performance as the function they replace. It would be nice to do two
> > > rounds, but we don't exactly have the CPU budget handy for that, and one
> > > round alone is already sufficient.
> > >
> >
> > I'm a bit confused by the argument here.  It's not SipHash-1-x that's used
> > elsewhere in the kernel, but rather SipHash-2-4.  HalfSipHash-1-3 is used too
> 
> Actually the hsiphash family of functions are aliased to SipHash-1-3 on 64-bit:
> 
> /* Note that on 64-bit, we make HalfSipHash1-3 actually be SipHash1-3, for
>  * performance reasons. On 32-bit, below, we actually implement HalfSipHash1-3.
>  */

That isn't mentioned in Documentation/security/siphash.rst at all.  It actually
makes it pretty clear that hsiphash() is "HalfSipHash".

> > So on 64-bit platforms it now throws away half of the pool.
> >
> > It should use 'u8 pool[sizeof(fast_pool->pool)]' to avoid hardcoding a size.
> 
> Actually the commit message notes that we intentionally dump half of
> it on 64bit. This is intentional.
> 

It doesn't explain *why* it does that.  Also, the code is much more important
than the commit message, and there's no explanation in the code at all; it just
looks like a bug.

- Eric